1. Field of the Invention
Embodiments of the present invention generally relate to virus detection techniques and, more particularly, a method and apparatus for mitigating false-positive generation in antivirus software.
2. Description of the Related Art
As antivirus software distributors and developers continue to innovate their protection technologies to accommodate the growing number of different forms of malicious software (malware) seen on networks today, antivirus technologies are trending to use broader, more generic detection technologies such as generic signatures, behavior detections, and static file heuristics. While these broader detection technologies create better detection for new and unknown malware and malware variance, these technologies increase the potential for false-positives where an antivirus application wrongly identifies a legitimate file as malware. The cost of false-positives to a company using such antivirus techniques is very high. Wrongly removing a software application can in many cases greatly impact the user, leaving them with a system in an unbootable state or without internet access.
Such false-positive mishandling is especially a problem for operating system binaries. If any of the operating system files are wrongly identified as malware, the user system is likely to have severe side effects. The side effects may include having the computer become unusable.
Therefore, there is a need for a method for mitigating false-positives as detected by antivirus software.